Responders have confirmed that customer payment data was stolen in an intrusion. The incident response team lead asks whether the organization should report the crime to law enforcement. Who should make that decision?
Select an answer to reveal the explanation.
Short Explanation
Calling the police on a data theft has ripple effects: publicity, evidence handover and legal exposure. That's a business call, so the people who own the business make it with the lawyers at their elbow. You and your responders inform; you don't decide.
Full Explanation
Involving law enforcement affects the organization's legal position, reputation, evidence handling and the control it retains over the investigation. It can bring benefits, such as access to intelligence and the possibility of prosecution, and costs, such as public disclosure and seizure of systems as evidence. Because those consequences are business and legal matters, the decision belongs to senior management with advice from legal counsel, using criteria and authority defined in advance in the incident response plan. The detecting analyst understands the technical evidence but lacks the authority and the legal and business context to make the decision. The incident response team lead coordinates the response and should escalate the question, but acting alone bypasses the governance the plan establishes and may conflict with legal strategy or regulatory obligations. An external forensic firm provides independent technical expertise; it is not accountable for the organization's legal decisions and should not make them on the organization's behalf. Exam caveat: some regulations or contracts may require notification of particular authorities, which counsel should identify; the plan should reflect those requirements. Operational check: confirm the plan names who authorizes law enforcement contact, the criteria, the liaison and how evidence will be shared.